Segfault (using Python bindings)

[Kristaps Rāts]

When using MySQLdb(Python mysql bindings) with Ice segfaults or python errors occur upon terminating a program with SIGINT.

Most of the time the program segfaults, sometimes it displays one of the following error messages:

Fatal Python error: ceval: tstate mix-up

and

Fatal Python error: GC object already tracked
Traceback (most recent call last):
Aborted

The OS is Ubuntu 6.06 (Dapper Drake) running on a dual processor machine.
Ice and IcePy version is 3.2.0, compiled with gcc 4.0.3
Python version is 2.4.3, MySQLdb version is 1.2.1rc3
(all packages except Ice are stock distro packages)

Testcase:

whatever.ice :

module Whatever
{
        interface Widget
        {
                void doSomething ();
        };
};

config.server :

Whatever.Endpoints = tcp -p 10000

testcase.py :

#!/usr/bin/env python
# -*- encoding: utf-8 -*-
import sys, Ice, MySQLdb

Ice.loadSlice ("whatever.ice")
import Whatever

class WidgetI (Whatever.Widget):

        def __init__ (self):
                self.db = MySQLdb.connect (user="", passwd="") # your db config here
                self.cursor = self.db.cursor() # doesn't segfault when this line is removed

        def doSomething (self, current=None):
                return

        def shutdown (self, current=None):
                # never reached
                self.cursor.close()
                self.db.close()
                current.adapter.getCommunicator().shutdown()

class Server (Ice.Application):
        def run (self, args):
                adapter = self.communicator().createObjectAdapter("Whatever")
                adapter.add (WidgetI(), self.communicator().stringToIdentity("Widget"))
                adapter.activate()
                self.communicator().waitForShutdown()
                return 0

app = Server();
sys.exit (app.main (sys.argv, "config.server"))

The segfault occurs upon terminating via Ctrl-C or kill -INT pid

Stacktrace upon receiving SIGSEGV:

#0  0x080c963b in PyErr_Fetch ()
#1  0x0809583c in PyType_Ready ()
#2  0x08089d4b in _PyType_Lookup ()
#3  0x0807a335 in PyDict_Next ()
#4  0x08089f7b in _PyType_Lookup ()
#5  0xb7bfe410 in ~ServantWrapper (this=0x81f9d28) at ObjectAdapter.cpp:126
#6  0xb7a4e0b4 in IceInternal::GCShared::__decRef (this=0x81f9d4c) at GC.cpp:91
#7  0xb7aba0b2 in IceInternal::decRef (p=0x81f9d4c) at Object.cpp:21
#8  0xb7c01f08 in ~Handle (this=0x81f9cfc) at Handle.h:91
#9  0xb7c03643 in ~pair (this=0x81f9cf8) at stl_pair.h:69
#10 0xb7c0369f in __gnu_cxx::new_allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > >::destroy (this=0xb72ce37f, __p=0x81f9cf8) at new_allocator.h:107
#11 0xb7c0373b in std::_Rb_tree<std::string, std::pair<std::string const, IceInternal::Handle<Ice::Object> >, std::_Select1st<std::pair<std::string const, IceInternal::Handle<Ice::Object> > >, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > >::destroy_node (this=0x81f0e70, __p=0x81f9ce8) at stl_tree.h:389
#12 0xb7c037ce in std::_Rb_tree<std::string, std::pair<std::string const, IceInternal::Handle<Ice::Object> >, std::_Select1st<std::pair<std::string const, IceInternal::Handle<Ice::Object> > >, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > >::_M_erase (this=0x81f0e70, __x=0x81f9ce8) at stl_tree.h:1097
#13 0xb7c0380d in ~_Rb_tree (this=0x81f0e70) at stl_tree.h:571
#14 0xb7c038b1 in ~map (this=0x81f0e70) at stl_map.h:92
#15 0xb7b00be3 in ~pair (this=0x81f0e68) at stl_pair.h:69
#16 0xb7b00c3f in __gnu_cxx::new_allocator<std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > > >::destroy (this=0xb72ce46f, __p=0x81f0e68) at new_allocator.h:107
#17 0xb7b00e65 in std::_Rb_tree<Ice::Identity, std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > >, std::_Select1st<std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > > >, std::less<Ice::Identity>, std::allocator<std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > > > >::destroy_node (
    this=0xb72ce604, __p=0x81f0e58) at stl_tree.h:389
#18 0xb7b00ef8 in std::_Rb_tree<Ice::Identity, std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > >, std::_Select1st<std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > > >, std::less<Ice::Identity>, std::allocator<std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > > > >::_M_erase (
    this=0xb72ce604, __x=0x81f0e58) at stl_tree.h:1097
#19 0xb7b00fc7 in std::_Rb_tree<Ice::Identity, std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > >, std::_Select1st<std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > > >, std::less<Ice::Identity>, std::allocator<std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > > > >::clear (this=0xb72ce604)
    at stl_tree.h:667
#20 0xb7b0103b in std::map<Ice::Identity, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > >, std::less<Ice::Identity>, std::allocator<std::pair<Ice::Identity const, std::map<std::string, IceInternal::Handle<Ice::Object>, std::less<std::string>, std::allocator<std::pair<std::string const, IceInternal::Handle<Ice::Object> > > > > > >::clear (this=0xb72ce604) at stl_map.h:465
#21 0xb7afe19c in IceInternal::ServantManager::destroy (this=0x81ccdb0) at ServantManager.cpp:374
#22 0xb7aa8e86 in Ice::ObjectAdapterI::destroy (this=0x81ccce8) at ObjectAdapterI.cpp:329
#23 0xb7aa167f in IceUtilInternal::SecondVoidMemFun<std::string const, Ice::ObjectAdapterI, IceUtil::Handle<Ice::ObjectAdapterI> >::operator() (this=0xb72ce6fc, pair=@0xb72ce6d8)
    at Functional.h:125
#24 0xb7aa16c7 in std::for_each<std::_Rb_tree_iterator<std::pair<std::string const, IceUtil::Handle<Ice::ObjectAdapterI> > >, IceUtilInternal::SecondVoidMemFun<std::string const, Ice::ObjectAdapterI, IceUtil::Handle<Ice::ObjectAdapterI> > > (__first={_M_node = 0x81fb4b0}, __last={_M_node = 0xb72ce73c}, __f=
        {<std::unary_function<std::pair<const std::basic_string<char, std::char_traits<char>, std::allocator<char> >, IceUtil::Handle<Ice::ObjectAdapterI> >,void>> = {<No data fields>}, _mfn = {__pfn = 0x39, __delta = 0}}) at stl_algo.h:158
#25 0xb7aa07fc in IceInternal::ObjectAdapterFactory::destroy (this=0x81d77a0) at ObjectAdapterFactory.cpp:127
#26 0xb7a6591f in IceInternal::Instance::destroy (this=0x81dbf08) at Instance.cpp:847
#27 0xb7a13e34 in Ice::CommunicatorI::destroy (this=0x81ab3e0) at CommunicatorI.cpp:74
#28 0xb7becbeb in communicatorDestroy (self=0xb74cea60) at Communicator.cpp:286
#29 0x080b606f in PyEval_EvalFrame ()
#30 0x080b713b in PyEval_EvalFrame ()
#31 0x080b713b in PyEval_EvalFrame ()
#32 0x080b713b in PyEval_EvalFrame ()
#33 0x080b781f in PyEval_EvalCodeEx ()
#34 0x080fc13d in PyFunction_SetClosure ()
#35 0x0805946c in PyObject_Call ()
#36 0x0805f005 in PyMethod_New ()
#37 0x0805946c in PyObject_Call ()
#38 0x080b0583 in PyEval_CallObjectWithKeywords ()
#39 0x080e074d in _PyObject_GC_NewVar ()
#40 0xb7f6a341 in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#41 0xb7ed74ee in clone () from /lib/tls/i686/cmov/libc.so.6

[matthew]

Thanks for the bug report. We've duplicated the error and are looking into it.

[mes]

Hi,

The crash is caused by a bug in the Ice extension. We will include a fix in the next release. If you want to fix this yourself, change to the IcePy source tree and open modules/ObjectAdapter.cpp. Around line 124, change the ServantWrapper destructor to the following:

IcePy::ServantWrapper::~ServantWrapper()                  
{               
    AdoptThread adoptThread; // ADD THIS LINE
    Py_DECREF(_servant);
}

Thanks for reporting this.

Take care,
- Mark

[Kristaps Rāts]

Yes, it works now, thank you.